The Essential Eight is a set of eight baseline cyber-security mitigation strategies published by the Australian Signals Directorate through its Australian Cyber Security Centre (ACSC). Together they are designed to make it much harder, and much more expensive, for an attacker to break into your systems and stay there. For a growing number of Australian businesses, especially those that tender for government work, the Essential Eight has shifted from a nice-to-have checklist to something you may be asked to prove.
What the eight controls actually are
The framework is deliberately short. It is not a 200-page standard, it is eight practical things to get right. Here they are in the ACSC’s own grouping, with the plain-English version of each.
- Application control. Only let approved programs run. If it is not on the allow-list, it does not execute, which stops a lot of malware before it starts.
- Patch applications. Keep your software updated, particularly anything internet-facing like browsers and email clients. Attackers love a known, unpatched hole.
- Configure Microsoft Office macros. Block macros from the internet and only allow ones you trust. Booby-trapped documents are a classic entry point.
- User application hardening. Turn off risky features you do not need, such as Flash, ads in browsers, and unnecessary Java, so there is less to attack.
- Restrict administrative privileges. Not everyone needs the keys to the building. Limit admin rights, review them, and keep admin accounts separate from day-to-day logins.
- Patch operating systems. Same idea as patching applications, applied to Windows, macOS, and your servers. Retire anything the vendor no longer supports.
- Multi-factor authentication (MFA). A password alone is not enough. A second factor, like a code or a token, stops most stolen-password attacks cold.
- Regular backups. Back up your important data, keep copies offline or otherwise out of reach, and actually test that you can restore. This is your lifeline if ransomware hits.
If you only read one of those twice, make it MFA and backups. They are the two that most often turn a catastrophe into an inconvenience.
Maturity levels, from Zero to Three
Implementing a control is not a simple yes or no. The ACSC rates how thoroughly you have done it across four maturity levels, and the bar genuinely matters.
| Maturity level | Roughly what it means |
|---|---|
| Level Zero | Significant weaknesses; the control is largely not in place |
| Level One | Protects against common, opportunistic attackers using widely available tools |
| Level Two | Protects against more capable attackers willing to invest time and effort |
| Level Three | Protects against adaptive, well-resourced attackers who tailor their approach |
The ACSC’s guidance is to pick a target maturity level for your whole organisation based on your risk, then bring all eight controls up to it together, rather than gold-plating one and ignoring another. A business at Level Two for MFA but Level Zero for backups has a very visible soft spot.
Decide your target maturity before you buy the platform, not after the tender asks for it.
Why this is now a procurement question
Here is the part that catches businesses out. For federal government contractors, and an expanding list of state-government panel suppliers, a target maturity, often Level Two, has moved from aspirational language to an actual tender requirement. You may be asked to attest to it, or to evidence it, as a condition of being eligible to bid at all.
That changes the maths on technology decisions. If you choose a platform, an enterprise resource planning system, or a managed service that quietly assumes everyone is an admin, or that cannot support modern MFA, you may find yourself unwinding that choice within a year or two when a contract requires it. A decision made on price and features alone, with security treated as an afterthought, can need redoing at exactly the wrong moment.
The practical move is to treat the Essential Eight as a lens you hold up to every significant systems choice. When you are comparing options, as with any serious business software in Australia, ask whether the vendor supports application control, restricted privileges, and MFA out of the box, or whether you are bolting it on later at extra cost.
Where to start if you are behind
You do not have to reach Level Three overnight, and most small and medium businesses should not aim there. A sensible sequence looks like this. First, turn on MFA everywhere it is available, starting with email and remote access. Second, get backups working, offline and tested. Third, tighten administrative privileges so fewer accounts can do serious damage. Those three alone close off a large share of the most common incidents.
From there, patching applications and operating systems on a predictable schedule, hardening user applications, and configuring macros fill out the rest. None of it is glamorous, and all of it ages, so the framework is meant to be maintained, not finished once and forgotten.
If you want a hand mapping your current state against the levels and building a realistic plan, it can be worth bringing in a specialist to get help meeting the Essential Eight rather than guessing. An outside review tends to find the soft spots you have stopped noticing.
A short note: this is general information, not security, legal, or procurement advice for your specific situation. Figures and requirements above were last checked June 2026, and the rules, tender thresholds, and ACSC guidance change. Always confirm the current detail against the official ACSC source and the specific tender you are responding to.
The bottom line
The Essential Eight is eight plain controls, rated across four maturity levels, that together make a real difference to how exposed your business is. For anyone who tenders for government work, it has quietly become a procurement gate rather than a security nicety, so the cheapest time to factor it in is before you sign for your next platform, not after a contract demands it. Pick a target level, bring all eight controls up to it, and treat it as ongoing maintenance, because attackers certainly will.